Guest user Created: Mar 09, 2018 Last commented: Mar 09, 2018

Retention period

I have a question about retention periods in EU (Norway). Our firm has developed a virtual assistant where we store all the customer conversations. The chat encourages the user to not state any personal information but in the event that this happens we delete all the logs every 30 days. There is no way to track the user or identify their identity once it is saved. My question is after a chat with another specialist he told us that we have to store the chats for 12 months. But is it GDPR compliant to delete them every month instead? So we don't store more data then necessary. Or is there a part of the GDPR law that requires us to store it for 12 months in case any personal data would be included in one of the chat?

0 0

Assign topic to the user

Select user

Expert

Andrei Hanganu Mar 09, 2018

Answer:

Article 5(e) - “Principles relating to processing of personal data” of the EU GDPR states that personal data should be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed” (https://advisera.com/gdpr/principles-relating-to-processing-of-personal-data/ ). And this is the only mention about an retention period.

It is up to the controller to establish suitable retention periods unless those are specified in local law. So my advice is to ask someone with a legal background if such obligation exists under Norwegian law and if not, you can keep deleting the chat content every 30 days.

You can find additional information about data retention in our “EU GDPR Foundations Course” (https://advisera.com/training/eu-gdpr-foundations-course//).

Quote

0 0

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

Mar 09, 2018

Expert Advice Community